Use upstream version of gosec

[dhui]

Addresses: #239

There's a lot of noise in the PR diff since I ran go mod tidy and go mod vendor. The only changes I made were in pkg/golinters/gas.go, the rest of the changes were made by the Go tool chain.

Also, github.com/stretchr/testify was automatically updated from v1.2.1 to v1.2.2 by the Go tool chain, which shouldn't cause any issues...

[dhui]

Ahhh, turns out using the upstream version of gosec isn't that simple since the golangci forked version adds the ProcessProgram() method to gosec.Analyzer which works with loaded programs instead of package path strings.

[jirfag]

closing, I will do it myself